Mattermost CVE-2026-14298

Exploitation requires a valid Mattermost account with sufficient permissions to access the Boards feature and its archive import endpoint. The CVSS PR:L metric confirms that low-privilege (standard user) authentication is sufficient - administrator or elevated roles are not required. The Boards feature must be enabled in the Mattermost instance (it is available by default in supported versions). No special server configuration, no interaction from another user, and no specific client platform are required beyond network access to the import endpoint. Limiting factors include: the attacker must possess a valid credential (account compromise or insider threat required), and instances with Boards explicitly disabled via the System Console are not affected. Cloud-managed Mattermost instances may have resource limits imposed by the hosting environment that partially mitigate the impact severity.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is consistent with the described behavior: network-reachable, low complexity, requiring only a standard authenticated session. The score of 6.5 (Medium) reflects the absence of confidentiality or integrity impact and the requirement for a valid account. EPSS data was not provided in the source intelligence, and the vulnerability does not appear in CISA KEV, suggesting it has not yet seen observed exploitation in the wild. No public proof-of-concept has been identified. The practical risk is strongest for organizations running self-hosted Mattermost with Boards enabled and broad internal user bases, where even a single disgruntled or compromised low-privilege account can trigger a server-wide outage - and even a mid-sized municipal IT team in zabrze operating a community Mattermost instance should treat this as a realistic service-continuity risk given the low exploitation barrier once authenticated. The 'Information Disclosure' tag present in the source data appears to be a metadata error; no confidentiality impact is described in the vulnerability or reflected in the CVSS vector. Organizations on cloud-managed Mattermost should confirm whether the vendor applies patches automatically.

An authenticated Mattermost user - for example, a member of a team with Boards access - crafts a .boardarchive file containing highly compressed repetitive data designed to expand to gigabytes or terabytes upon decompression. The user uploads this file to the Boards archive import endpoint. The server begins decompressing the payload without applying size bounds, exhausting available RAM or filling the disk partition, causing the Mattermost service to become unresponsive or crash for all users. No publicly available exploit code is known at time of analysis, but the attack technique is well-understood and straightforward to implement given knowledge of the .boardarchive format.